This page distinguishes external authorization permissions from data-processing consent.

Consent and authorization boundaries

Microsoft Graph authorization permissions

For SharePoint access through Microsoft Graph, the documented walkthrough recommends delegated permissions when the integration should act as the logged-in user.

A delegated permission lets the integration act as the logged-in user. In the walkthrough’s example, SharePoint search can return documents that the logged-in user has access to. The walkthrough also states that the Graph API calls are made by the server rather than directly by the browser client.

An application permission gives permissions to the application itself rather than making it act as the logged-in user. The application’s effective access depends on the rights granted to that application.

Some permissions may require administrator consent. Where administrator consent is required, an administrator can grant consent for the organization; a developer who is not an administrator cannot assume that the requested permission will be available.

The walkthrough also describes configuring OpenID Connect settings with application identifiers, endpoints, redirect URIs, and a client secret. Treat such configuration values appropriately and do not expose secrets.

Data-processing consent

The supplied MDriven sources do not define a built-in consent-management capability or a prescribed workflow for collecting a person’s agreement to a processing purpose, storing a consent record, handling withdrawal, or maintaining an audit history.

See also

• Training:Information security
• MDriven GraphAPI Sharepoint Document Access